spam acl condition: cannot parse spamd output

[santrix]

I'm getting a few of these in the exim_paniclog

I cought the last time it happened as I was trying to SSH in, and found it took ages, and then found that spamd was running at over 90% and stayed there for almost a minute before returning to normal. I checked the logs for activity under the user account that was running spamd at such a high cpu quotient, and found the "spam acl condition" error. It's the only thing which shows up in the panic log:

cat /var/log/exim_paniclog
2009-09-21 09:59:15 1Mpeji-0004Oz-6e spam acl condition: cannot parse spamd output
2009-09-21 10:18:36 1Mpf2Z-0005q4-3d spam acl condition: cannot parse spamd output
2009-09-21 17:01:25 1MplKI-0001SH-4y spam acl condition: cannot parse spamd output
2009-09-22 12:10:23 1Mq3GB-0003WH-N4 spam acl condition: cannot parse spamd output
2009-09-22 12:10:36 1Mq3GH-0003WK-Fb spam acl condition: cannot parse spamd output
2009-09-22 14:05:58 1Mq52w-0003uP-Df spam acl condition: cannot parse spamd output
2009-09-22 14:08:24 1Mq54s-00040y-KE spam acl condition: cannot parse spamd output
2009-09-22 15:56:48 1Mq6n9-0004P8-PD spam acl condition: cannot parse spamd output
2009-09-22 15:58:12 1Mq6oh-0004XB-PS spam acl condition: cannot parse spamd output
2009-09-23 00:33:32 1MqEpe-0005Np-O4 spam acl condition: cannot parse spamd output
2009-09-23 14:08:33 1MqRZq-0006oW-L3 spam acl condition: cannot parse spamd output

I'm not sure why this is happening... server is not really heavily loaded, has 2Gb RAM and a quad core, with only about 150 mailboxes over 50 or so websites.

Interestingly, I have looked at the transaction for each of these messages, and in each case the size of the message was bigger than 7Mb, ranging up to 30Mb.... but I have already been told by Cpanel themselves that such large messages should not even be scanned by SA, so why is exim complaining it can't parse the output from SA?

[cPanelMattCurry]

Hello,


I do apologize for your issue, and after a little research I would go ahead and advise you to put in a ticket. This way we can take a little closer look, and get you going quicker. Please use the link at the bottom of this post to submit the ticket. Also, feel free to let me know if you have any questions.

Thank you,
Matthew Curry